← All detection heuristics · CVE
critical
RTF_OLE2LINK_REMOTE_MONIKER_LOADER
What it means
RTF OLE2Link object is force-activated with \objupdate and fetches a remote second stage via an INCLUDE field.
Why it fires
Field-delivered OLE2Link auto-update attack path shared by CVE-2017-0199 and CVE-2017-8759: an OLE2Link object (Package/OLE2Link CLSID {00000300-0000-0000-C000-000000000046}) is auto-activated on open via \objupdate (no user interaction), and the remote loader URL is carried in an INCLUDETEXT/INCLUDEPICTURE field rather than an inline URL Moniker — so the moniker-based detector does not fire. The two CVEs share this exact RTF artifact and diverge only in the C2 response: CVE-2017-0199 returns an HTA/scriptlet (OLE URL-moniker / htafile handler), CVE-2017-8759 returns a SOAP WSDL the .NET SOAP-moniker parser compiles. With the C2 unreachable the specific CVE is reported as RELATED, narrowing to a single CVE (LIKELY) only when the moniker URL carries a tell (.txt/!soap/wsdl -> 8759; .hta/.sct/script: -> 0199).
Other CVE heuristics
CVE_2026_34621_RELATED CVE_2023_26369 CVE_2026_34621 CVE_2010_1297_FLASH_RICHMEDIA CVE_2010_1297_SWF_TRIGGER CVE_2011_0611_SWF_TRIGGER CVE_2009_1862_FLASH_RICHMEDIA CVE_2010_2883 CVE_2018_4901 CVE_2009_3459 CVE_2018_4990_JPX_EMBEDDED_CMD CVE_2018_4990_JPX_CMAP_TRIGGER CVE_2010_1240 CVE_2010_0188 CVE_2014_0514 CVE_2013_3346 CVE_2013_0640 CVE_2010_3654_FLASH_RICHMEDIA CVE_2007_5020_MAILTO_MSHTA CVE_2014_0496 CVE_2008_2551 CVE_2021_40444 CVE_2006_4694 CVE_2008_0118